Infoblox Threat Intel
Original DNS Intelligence
Latest Research
Infoblox Blog | June 9, 2026
Residential Proxies in the Wild
Infoblox Threat Intel poses the question to network defenders: “Do you know who has access to your IP space?” with a look into residential proxy traffic.
Infoblox Blog | May 14, 2026
Lookalike Domains Expose the iPhone Theft Economy
Stolen iPhones are worthless when locked—until thieves use lookalike domains and underground unlocking tools to bypass Apple’s security and pwn the phone.
Infoblox Blog | April 23, 2026
Hold the Phone! International Revenue Share Fraud Driven by Fake CAPTCHAs
Fake CAPTCHA pages trick victims into sending dozens of international SMS messages, powering a large-scale international revenue share fraud operation.
Infoblox Threat Actors
Vault Viper
Vault Viper is a sophisticated threat actor linked to Southeast Asian organized crime. It deploys a custom browser to enable illegal online gambling…
Detour Dog
Detour Dog is a malicious adtech affiliate that uses DNS TXT records to conditionally redirect victims from tens of thousands of compromised web…
Vane Viper
Vane Viper is a malicious adtech ecosystem built around Cyprus-based, Russian nexus AdTech Holdings and its subsidiaries. They abuse push notific…
Threat Intelligence Resources
Stay ahead of emerging cyber risks with insights from Infoblox Threat Intel and the global community.
Filter by:
ALL BLOGS MEDIA ARTICLES PRESS RELEASES RESEARCH REPORTS REPORTS SOLUTION NOTES WEBINARS
Blog
Infoblox Threat Intel
December 1, 2025
DNS Uncovers Infrastructure Used in SSO Attacks
Learn how DNS was used to uncover Evilginx AITM infrastructure attacking U.S. university single sign-on (SSO) portals to phish student login credentials.
Blog
Infoblox Threat Intel
October 23, 2025
Vault Viper: High Stakes, Hidden Threats
Vault Viper is a threat actor leveraging DNS infrastructure and a custom browser for illegal gambling, and organized crime across Southeast Asia.
Blog
Infoblox Threat Intel
October 9, 2025
Pig Butchering Scams and Their DNS Trail: Linking Threats to Malicious Compounds
DNS analysis reveals how pig butchering scams link to criminal compounds in Southeast Asia, exposing fraud infrastructure and threat actor patterns.
Media Article
The Hacker News
October 6, 2025
Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More
The cyber world never hits pause, and staying alert matters more than ever. Every week brings new tricks, smarter attacks, and fresh lessons from the field.
Media Article
The Hacker News
October 3, 2025
Detour Dog Caught Running DNS-Powered Malware Factory for Strela Stealer
A threat actor named Detour Dog has been outed as powering campaigns distributing an information stealer known as Strela Stealer. That’s according to findings from Infoblox, which found the threat actor to maintain control of domains hosting the first stage of the stealer, a backdoor called StarFish.
Media Article
Techradar
October 3, 2025
Over 30,000 Sites Hit by DNS Malware
Security researchers have spotted an enormous malware campaign which managed to quietly compromise more than 30,000 websites, as well as countless visitors.
Media Article
SC Media
October 2, 2025
Over 30K sites compromised with Strela Stealer in Detour Dog campaign
Attacks involving server-side DNS exploitation have enabled cybercrime operation Detour Dog to inject the Strela Stealer malware into more than 30,000 websites worldwide, most of which are in the U.S., according to HackRead.
Media Article
HackRead
October 1, 2025
Detour Dog DNS Hijacking Malware Linked to Strela Stealer Payload
Infoblox reveals how the Detour Dog group used server-side DNS to compromise 30,000+ sites across 89 countries, installing the stealthy Strela Stealer malware.
Media Article
GB Hackers
October 1, 2025
Researchers Detect New DNS Malware 'Detour Dog' Fueling Global Cyberattacks
Detour Dog, a stealthy website malware campaign tracked since August 2023, has evolved from redirecting victims to tech-support scams into a sophisticated DNS-based command-and-control (C2) distribution system that delivers the Strela Stealer information stealer via DNS TXT records.
Blog
Infoblox Threat Intel
September 30, 2025
Detour Dog: DNS Malware Powers Strela Stealer Campaigns
Learn about Detour Dog, a malicious adtech ecosystem that uses DNS TXT records to instruct infected websites to redirect visitors or fetch remote content.
Media Article
CSO Online
September 12, 2025
Why domain-based attacks will continue to wreak havoc
Hackers are using AI to supercharge domain-based attacks, and most companies aren’t nearly ready to keep up. Among the numerous cyber threats that enterprises must contend with, domain-based attacks hold a prominent position.
Blog
Infoblox Threat Intel
September 9, 2025
Deniability by Design: DNS-Driven Insights into a Malicious Ad Network
Vane Viper’s operation is built for scale and evasion and provides a mechanism for them and other bad actors to run malicious ad campaigns.
Blog
Infoblox Threat Intel
August 14, 2025
Inside the Robot: Deconstructing VexTrio’s Affiliate Advertising Platform
VexTrio’s traffic distribution system (TDS) processes billons of transactions daily, powering digital fraud on a global scale. Here’s how we unraveled it.
Media Article
SC Media
August 13, 2025
DNS attacks surge with AI-driven tactics
Infoblox’s 2025 DNS Threat Landscape Report highlights a dramatic rise in DNS-based cyberattacks, with threat actors increasingly leveraging AI-driven deepfakes, malicious adtech, and evasive domain strategies, The Fast Mode reports.
Blog
Infoblox Threat Intel
August 12, 2025
VexTrio Unmasked: A Legacy of Spam and Homegrown Scams
We reveal how VexTrio has profited from spam and scams for decades, gaining persistent access to victims through fake captchas and browser notifications.
Media Article
Help Net Security
August 12, 2025
Why DNS threats should be on every CISO’s radar in 2025
DNS is once again in the crosshairs of threat actors. According to the 2025 DNS Threat Landscape Report by Infoblox, attackers are changing tactics, and enterprises are feeling the pressure.
Media Article
Security Middle East
August 11, 2025
Infoblox releases 2025 DNS Threat Landscape Report
Infoblox has shared its 2025 DNS Threat Landscape Report, revealing a significant rise in DNS-based cyber threats. The report indicates that of the 100.8 million newly observed domains, 25.1 per cent were classified as malicious or suspicious, while 82 per cent of environments encountered domains linked to malicious adtech.
Media Article
CXO Insight Middle East
August 7, 2025
Surge in AI-driven threats and malicious adtech, reveals Infoblox report
Infoblox has released its 2025 DNS Threat Landscape Report, revealing a dramatic surge in DNS-based cyber threats and the growing sophistication of adversaries leveraging AI-enabled deepfakes, malicious adtech and evasive domain tactics.
Media Article
TECHx
August 6, 2025
DNS Security Threats Rise Sharply in Infoblox Report
Infoblox, cloud networking and DNS security services, has released its 2025 DNS Threat Landscape Report. The report reveals a sharp rise in DNS-based cyber threats and highlights the growing use of AI in malicious activities.
Media Article
Tech It Up Middle East
August 6, 2025
Infoblox Unveils 2025 DNS Threat Landscape Report
Blog
Infoblox Threat Intel
August 6, 2025
VexTrio’s Origin Story : From Spam to Scam to Adtech
We expose adtech operators who partner with malware threat actors to commit digital fraud on a global scale through their affiliate advertising networks.
Media Article
Network World
August 4, 2025
Infoblox reinforces DNS defense package
The Infoblox Threat Defense platform analyzes DNS traffic to detect and stop malware, phishing, and ransomware.
Media Article
MSP Channel Insights
August 4, 2025
Infoblox Reports Surge in DNS Cyberthreats and AI-Powered Evasion Tactics
Infoblox’s latest report details a rise in DNS-based cyberthreats, highlighting sophisticated AI-enabled attacks that exploit vulnerabilities to deceive users and evade detection.
Media Article
Tech Collective Asia
June 18, 2025
Playing on fear: the lucrative business of scareware
You’re casually browsing the internet – maybe checking the news or searching for a recipe – when you receive a pop-up on the screen that your phone is infected. You’re urged to download an antivirus app before it’s “too late”.
Media Article
The Business Times
June 14, 2025
Now hiring: Scam victims
A job promising flexible hours, high pay, and the freedom to work from anywhere. No interviews, no tests – just a friendly text and a professional-looking website.
Blog
Infoblox Threat Intel
June 12, 2025
Vexing and Vicious: The Eerie Relationship between WordPress Hackers and an Adtech Cabal
A cabal of Russian-nexus adtech companies are the cybercriminal choice to drive users to scams and malware from millions of compromised sites.
Media Article
The Canberra Times
May 28, 2025
Recruitment scams are getting more sophisticated. Here's how to spot one
Picture this: you’re poolside in Bali, mojito in one hand and laptop in the other. You’ve cracked the system, really. A job with flexible working hours, great pay, work from home (or a resort) with training provided.
Media Article
Intelligent CISO
May 23, 2025
New cyberthreat ‘Hazy Hawk’ hijacks major domains – organisations are at risk
Infoblox uncovers a threat actor exploiting abandoned cloud resources to hijack subdomains of major organisations for scams and malware distribution.
Media Article
SC Media
May 21, 2025
Misconfigured DNS, neglected cloud assets harnessed in Hazy Hawk domain hijacking attacks
Hackread reports that newly identified threat operation Hazy Hawk has been exploiting DNS misconfigurations and deserted cloud resources to take over domains belonging to the Centers for Disease Control, the state of Alabama, the Australian Department of Health, the University of California at Berkeley, and the University College London, as well as Deloitte and PwC, since December 2023.
Media Article
CSO Online
May 20, 2025
Poor DNS hygiene is leading to domain hijacking
Infoblox says crooks are finding and taking over ‘dangling’ CNAME records for scams. Threat actors continue to find ways of hijacking domains thanks to poor DNS record-keeping and misconfigurations by administrators, a hole that CSOs have to plug or risk financial or reputational damage to their organizations.
Media Article
Dark Reading
May 20, 2025
'Hazy Hawk' Cybercrime Gang Swoops In for Cloud Resources
Since December 2023, the threat group has preyed on domains belonging to the US Centers for Disease Control and Prevention (CDC) and numerous other reputable organizations worldwide to redirect users to malicious sites.
Media Article
The Hacker News
May 20, 2025
Hazy Hawk Exploits DNS Records to Hijack CDC, Corporate Domains for Malware Delivery
A threat actor known as Hazy Hawk has been observed hijacking abandoned cloud resources of high-profile organizations, including Amazon S3 buckets and Microsoft Azure endpoints, by leveraging misconfigurations in the Domain Name System (DNS) records.
Media Article
Bleeping Computer
May 20, 2025
Hazy Hawk gang exploits DNS misconfigs to hijack trusted domains
A threat actor tracked as ‘Hazy Hawk’ is hijacking forgotten DNS CNAME records pointing to abandoned cloud services, taking over trusted subdomains of governments, universities, and Fortune 500 companies to distribute scams, fake apps, and malicious ads.
Media Article
Hack Read
May 20, 2025
Hazy Hawk Attack Spotted Targeting Abandoned Cloud Assets Since 2023
Infoblox reveals Hazy Hawk, a new threat exploiting abandoned cloud resources (S3, Azure) and DNS gaps since Dec 2023. Learn about their tactics and how to protect your organization and users.
Blog
Jacques Portal, Renée Burton
May 20, 2025
Cloudy with a Chance of Hijacking Forgotten DNS Records Enable Scam Actor
Learn about a threat actor who discovers lingering DNS records from discontinued cloud services and uses them to deliver scams through adtech.
Media Article
Dark Reading
May 7, 2025
RSAC 2025: Infoblox Is Thumbs-Up on NIST's DNS Protections Update
After a long hiatus, the federal agency updated Domain Name Sever (DNS) recommendations around protecting the network and the DNS protocol itself, say Scott Harrell and Mukesh Gupta of Infoblox.
Media Article
The Hacker News
May 6, 2025
New Investment Scams Use Facebook Ads, RDGA Domains, and IP Checks to Filter Victims
Cybersecurity researchers have lifted the lid on two threat actors that orchestrate investment scams through spoofed celebrity endorsements and conceal their activity through traffic distribution systems (TDSes).
Media Article
Intelligent CISO
May 6, 2025
From Facebook ads to fake news: Inside the World of Investment scam actors
US$ 5.7 billion – that is how much money U.S. consumers reported losing to investment scams in 2024. For context, that is enough to fund five Mars rover missions.
Blog
Infoblox Threat Intel
May 6, 2025
Telegram Tango: Dancing with a Scammer
Learn how scammers operate, the tactics they use, and how to protect yourself from falling victim to these sophisticated cybercrimes.
Blog
Darby Wise, Piotr Glaska, Laura da Rocha
April 28, 2025
Uncovering Actor TTP Patterns and the Role of DNS in Investment Scams
Dive into the similarities between large-scale investment scams and learn how DNS abuse fuels this billion-dollar industry.
Blog
Infoblox Threat Intel
April 4, 2025
Disrupting Fast Flux and Much More with Protective DNS
A recent cybersecurity advisory from the Cybersecurity and Infrastructure Security Agency (CISA) discussed the use by threat actors of a DNS technique known as fast flux.
Blog
Infoblox Threat Intel
March 27, 2025
A Phishing Tale of DoH and DNS MX Abuse
Large-scale phishing attacks use DoH and DNS MX records to dynamically serve fake login pages.
Blog
Jason Hill
March 13, 2025
Work Hard, Pay Harder!
Cybercriminals targeting individuals globally via messaging services with industrial-scale recruitment scam infrastructure.
Blog
Cricket Liu
March 10, 2025
How scammers hijack major brands
Learn how threat actors exploited dangling CNAME records to distribute malware and other malicious content, and find out how to protect your organization from similar attacks.
Blog
Renée Burton
March 6, 2025
Survey Says...It’s a Scam!
Bad actors use malicious adtech to deliver survey, sweepstakes and fake gift card scams to generate ad revenue and trick victims into time-consuming interactions that lead to theft of personal data and credit card fraud.
Blog
Bart Lenaerts-Bergmans
February 26, 2025
DNS Early Detection - Fast Propagating Fake Captcha distributes LummaStealer
Lumma Stealer, also known as LummaC2, is a type of malware that first appeared in 2022. It is designed to steal sensitive information from infected systems.
Blog
Infoblox Threat Intel
February 25, 2025
The Hidden Dangers of Malicious Adtech
Learn why malicious adtech is a risk for organizations of all sizes.
Blog
Renée Burton
January 27, 2025
Pushed Down the Rabbit Hole
The adverse impact of visiting compromised domains that integrate malicious adtech.
Blog
David Brunsdon
January 14, 2025
One Mikro Typo: How a simple DNS misconfiguration enables malware delivery by a Russian botnet
Russian threat actors combine domain name vulnerabilities with hidden router proxy techniques to scale their attacks while remaining shielded from detection.
Blog
Infoblox Threat Intel
January 8, 2025
Lessons from a Malspam Hunt
Explore how Infoblox Threat Intel analyzed spam campaigns originating behind the Great Chinese Firewall. Learn more about the usage of domain spoofing and the specific tactics used against victims.
Blog
Infoblox Threat Intel
November 14, 2024
DNS Predators Hijack Domains to Supply their Attack Infrastructure
Learn how DNS threat actors hijack domains and use them in their malicious campaigns.
Blog
Dave Mitchell and Adam Casella
October 15, 2024
Beware of Domain Collisions: Are Your Internal Domains Registered Externally?
Learn why understanding this risk is crucial for safeguarding your organization’s digital identity and preventing unauthorized access.
Blog
Infoblox Threat Intel
September 18, 2024
No, Elon Musk was not in the U.S. Presidential Debate
Cybercriminals used presidential debate-themed deep fake YouTube videos to advertise cryptocurrency scams.
Blog
Infoblox Threat Intel
July 31, 2024
Who Knew? Domain Hijacking Is So Easy
Learn about the insidious DNS attack vector that threat actors are using to hijack domains from major brands, government institutions…
Blog
Kat Persighetti
July 29, 2024
Olympics Scammers Take Their Marks, Get Set, and Go!
Every iteration of the Olympic games is a major global event – fueling pride and competition, watched by millions in homes around the world,…
Press Release
Infoblox Threat Intel
July 22, 2024
Infoblox Exposes: Chinese Cybercrime Syndicate Linking European Football Sponsors, Human Trafficking and a Trillion-Dollar Illegal Gambling Economy
Santa Clara, Calif., July 22, 2024 — Infoblox Inc., a leader in cloud networking and security services, today announced a significant breakthrough in cybercrime…
Blog
Maël Le Touz, Jacques Portal, Renée Burton,
and Elena Puga
July 22, 2024
Gambling is No Game: DNS Links Between Chinese Organized Crime and Sports Sponsorships
Learn how the detection of a single anomalous domain led to the discovery of a vast enterprise leveraging sports sponsorships for Chinese organized crime.
Report
Maël Le Touz, Jacques Portal, Renée Burton,
and Elena Puga
July 22, 2024
Vigorish Viper: A Venomous Bet
This groundbreaking report unveils the discovery of a technology suite and its connection to Chinese organized crime, money laundering, and human trafficking throughout Southeast Asia.
Press Release
Infoblox Threat Intel
July 17, 2024
Revolver Rabbit’s Million-Dollar Masquerade: Infoblox Uncovers The Hidden World of RDGAs
Santa Clara, Calif., July 17, 2024 — Infoblox Threat Intel released a threat landscape study of the use of registered domain generation algorithms (RDGAs) by malicious actors today.
Blog
James Barnett
July 17, 2024
RDGAs: The Next Chapter in Domain Generation Algorithms
Infoblox Threat Intel exposes registered DGAs (RDGAs), the novel DGAs that our research has found are often used to host phishing and scam sites and deliver malware.
Blog
Renée Burton and Dave Mitchell
June 3, 2024
What a Show! An Amplified Internet Scale DNS Probing Operation
Learn how Chinese actors are probing DNS networks around the world and how an attack surface management tool is amplifying the suspicious activity.
Blog
Infoblox Threat Intel
May 28, 2024
VexTrio Viper Adds a New DNS TDS Domain
Learn how VexTrio Viper adapts to industry reporting and about the role of Infoblox Threat Intel in identifying and responding to these changes. Despite their adaptations, VexTrio Viper is still detectable.
Blog
Dr. Renée Burton
April 29, 2024
Muddling Meerkat Blog Post
This paper introduces a perplexing actor, Muddling Meerkat, who appears to be a People’s Republic of China (PRC) nation state actor.
Report
Infoblox Threat Intel
April 29, 2024
Muddling Meerkat Report
Sometimes there are threats we can observe but not fully understand. This might be doubly
true when the evidence comes from Domain Name System (DNS) logs.
Solution Note
Infoblox
April 26, 2024
Threat Insight
Real Time Inspection of Enterprise Network DNS Traffic to Detect Unknown Threats.
Solution Note
Infoblox
April 26, 2024
Infoblox Threat Intel
Uplift the entire security stack by optimizing your custom blend of threat intelligence.
Blog
Infoblox Threat Intel
February 28, 2024
Beware the Shallow Waters: Savvy Seahorse Lures Victims to Fake Investment Platforms Through Facebook Ads
Learn how the threat actor Savvy Seahorse Facebook ads to lure users to fake investment platforms and leverages DNS to allow their attacks to persist for years.
Media Article
Bleeping Computer
February 28, 2024
Savvy Seahorse gang uses DNS CNAME records to power investor scams
A threat actor named Savvy Seahorse is abusing CNAME DNS records Domain Name System to create a traffic distribution system that powers financial scam campaigns.
Blog
Infoblox Threat Intel
February 20, 2024
Ivanti Connect Secure VPN Exploitation – Correctly Interpreting DNS IoCs
Domains in a list of IoCs such as the ones found in recent articles about attacks involving Ivanti 0-days are a valuable product of incident response, but they can’t simply be added to a blocklist.
Media Article
Tech Republic
February 9, 2024
Infoblox says IT Pros are Missing this Mega-Threat from Organised Global Cyber Criminals
Cyber security threat actor VexTrio is flying under the radar for most APAC region cyber security professionals because it is a web traffic distribution middle man rather than an endpoint source of malware.
Blog
Infoblox Threat Intel
January 23, 2024
Cybercrime Central: VexTrio Operates Massive Criminal Affiliate Program
DNS threat actor VexTrio runs a large-scale criminal affiliate program including ClearFake and SocGholish actors.
Solution Note
Infoblox
October 31, 2023
DNS-Based Threat Hunting For Unveiling Threats Early Before They Strike
The scope of DNS is enormous. There are now 1589 top level domains and 200,000 new
domains are created everyday.
Blog
Infoblox Threat Intel
October 31, 2023
Prolific Puma: Shadowy Link Shortening Service Enables Cybercrime
Learn how a link shortening service that supports cybercrime remained undetected for years and was discovered via Domain Name Service (DNS) analytics.
Media Article
Krebs on Security
October 31, 2023
.US Harbors Prolific Malicious Link Shortening Service
The top-level domain for the United States — .US — is home to thousands of newly-registered domains tied to a malicious link shortening service that facilitates malware and phishing scams, new research suggests.
Blog
Infoblox Threat Intel
October 3, 2023
Lookalike Domain Attacks are on the Rise. Be on the Lookout for these Four Types
Explore the rise of lookalike domain attacks and their potential threats.
Webinar
Dr. Renée Burton
September 5, 2023
Decoy Dog is No Ordinary Pupy: Separating a Sly DNS Malware from the Pack
In April 2023, Infoblox disclosed the discovery of Decoy Dog, a malware toolkit that uses the domain name system (DNS) to perform command and control (C2).
Blog
Infoblox Threat Intel
July 25, 2023
Decoy Dog is No Ordinary Pupy: Separating a Sly DNS Malware from the Pack
The article provides a brief overview of our conclusions. Get the full report, including our Decoy Dog YARA rule, here and read the original paper here.
Report
Infoblox Threat Intel
July 25, 2023
Decoy Dog is No Ordinary Pupy: Separating a Sly DNS Malware from the Pack
Decoy Dog is a malware toolkit discovered by Infoblox that uses the domain name system (DNS) to perform command and control (C2).
Report
Infoblox Threat Intel
April 24, 2023
A Deep3r Look at Lookal1ke Attacks
Threat actors have used visually similar domains to deceive users into visiting malicious websites since the advent of the internet.
All Resources
‹›
Blog
Infoblox Threat Intel
December 1, 2025
DNS Uncovers Infrastructure Used in SSO Attacks
Learn how DNS was used to uncover Evilginx AITM infrastructure attacking U.S. university single sign-on (SSO) portals to phish student login credentials.
Blog
Infoblox Threat Intel
October 23, 2025
Vault Viper: High Stakes, Hidden Threats
Vault Viper is a threat actor leveraging DNS infrastructure and a custom browser for illegal gambling, and organized crime across Southeast Asia.
Blog
Infoblox Threat Intel
October 9, 2025
Pig Butchering Scams and Their DNS Trail: Linking Threats to Malicious Compounds
DNS analysis reveals how pig butchering scams link to criminal compounds in Southeast Asia, exposing fraud infrastructure and threat actor patterns.
Media Article
The Hacker News
October 6, 2025
Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More
The cyber world never hits pause, and staying alert matters more than ever. Every week brings new tricks, smarter attacks, and fresh lessons from the field.
Media Article
The Hacker News
October 3, 2025
Detour Dog Caught Running DNS-Powered Malware Factory for Strela Stealer
Media Article
Techradar
October 3, 2025
Over 30,000 Sites Hit by DNS Malware
Security researchers have spotted an enormous malware campaign which managed to quietly compromise more than 30,000 websites, as well as countless visitors.
Media Article
SC Media
October 2, 2025
Over 30K sites compromised with Strela Stealer in Detour Dog campaign
Media Article
HackRead
October 1, 2025
Detour Dog DNS Hijacking Malware Linked to Strela Stealer Payload
Infoblox reveals how the Detour Dog group used server-side DNS to compromise 30,000+ sites across 89 countries, installing the stealthy Strela Stealer malware.
Media Article
GB Hackers
October 1, 2025
Researchers Detect New DNS Malware 'Detour Dog' Fueling Global Cyberattacks
Blog
Infoblox Threat Intel
September 30, 2025
Detour Dog: DNS Malware Powers Strela Stealer Campaigns
Learn about Detour Dog, a malicious adtech ecosystem that uses DNS TXT records to instruct infected websites to redirect visitors or fetch remote content.
Media Article
CSO Online
September 12, 2025
Why domain-based attacks will continue to wreak havoc
Blog
Infoblox Threat Intel
September 9, 2025
Deniability by Design: DNS-Driven Insights into a Malicious Ad Network
Vane Viper’s operation is built for scale and evasion and provides a mechanism for them and other bad actors to run malicious ad campaigns.
Blog
Infoblox Threat Intel
August 14, 2025
Inside the Robot: Deconstructing VexTrio’s Affiliate Advertising Platform
VexTrio’s traffic distribution system (TDS) processes billons of transactions daily, powering digital fraud on a global scale. Here’s how we unraveled it.
Media Article
SC Media
August 13, 2025
DNS attacks surge with AI-driven tactics
Blog
Infoblox Threat Intel
August 12, 2025
VexTrio Unmasked: A Legacy of Spam and Homegrown Scams
We reveal how VexTrio has profited from spam and scams for decades, gaining persistent access to victims through fake captchas and browser notifications.
Media Article
Help Net Security
August 12, 2025
Why DNS threats should be on every CISO’s radar in 2025
Media Article
Security Middle East
August 11, 2025
Infoblox releases 2025 DNS Threat Landscape Report
Media Article
CXO Insight Middle East
August 7, 2025
Surge in AI-driven threats and malicious adtech, reveals Infoblox report
Media Article
TECHx
August 6, 2025
DNS Security Threats Rise Sharply in Infoblox Report
Media Article
Tech It Up Middle East
August 6, 2025
Infoblox Unveils 2025 DNS Threat Landscape Report
Blog
Infoblox Threat Intel
August 6, 2025
VexTrio’s Origin Story : From Spam to Scam to Adtech
We expose adtech operators who partner with malware threat actors to commit digital fraud on a global scale through their affiliate advertising networks.
Media Article
Network World
August 4, 2025
Infoblox reinforces DNS defense package
The Infoblox Threat Defense platform analyzes DNS traffic to detect and stop malware, phishing, and ransomware.
Media Article
MSP Channel Insights
August 4, 2025
Infoblox Reports Surge in DNS Cyberthreats and AI-Powered Evasion Tactics
Media Article
Tech Collective Asia
June 18, 2025
Playing on fear: the lucrative business of scareware
Media Article
The Business Times
June 14, 2025
Now hiring: Scam victims
Blog
Infoblox Threat Intel
June 12, 2025
Vexing and Vicious: The Eerie Relationship between WordPress Hackers and an Adtech Cabal
A cabal of Russian-nexus adtech companies are the cybercriminal choice to drive users to scams and malware from millions of compromised sites.
Media Article
The Canberra Times
May 28, 2025
Recruitment scams are getting more sophisticated. Here's how to spot one
Media Article
Intelligent CISO
May 23, 2025
New cyberthreat ‘Hazy Hawk’ hijacks major domains – organisations are at risk
Infoblox uncovers a threat actor exploiting abandoned cloud resources to hijack subdomains of major organisations for scams and malware distribution.
Media Article
SC Media
May 21, 2025
Misconfigured DNS, neglected cloud assets harnessed in Hazy Hawk domain hijacking attacks
Media Article
CSO Online
May 20, 2025
Poor DNS hygiene is leading to domain hijacking
Media Article
Dark Reading
May 20, 2025
'Hazy Hawk' Cybercrime Gang Swoops In for Cloud Resources
Media Article
The Hacker News
May 20, 2025
Hazy Hawk Exploits DNS Records to Hijack CDC, Corporate Domains for Malware Delivery
Media Article
Bleeping Computer
May 20, 2025
Hazy Hawk gang exploits DNS misconfigs to hijack trusted domains
Media Article
Hack Read
May 20, 2025
Hazy Hawk Attack Spotted Targeting Abandoned Cloud Assets Since 2023
Blog
Jacques Portal, Renée Burton
May 20, 2025
Cloudy with a Chance of Hijacking Forgotten DNS Records Enable Scam Actor
Learn about a threat actor who discovers lingering DNS records from discontinued cloud services and uses them to deliver scams through adtech.
Media Article
Dark Reading
May 7, 2025
RSAC 2025: Infoblox Is Thumbs-Up on NIST's DNS Protections Update
Media Article
The Hacker News
May 6, 2025
New Investment Scams Use Facebook Ads, RDGA Domains, and IP Checks to Filter Victims
Media Article
Intelligent CISO
May 6, 2025
From Facebook ads to fake news: Inside the World of Investment scam actors
Blog
Infoblox Threat Intel
May 6, 2025
Telegram Tango: Dancing with a Scammer
Learn how scammers operate, the tactics they use, and how to protect yourself from falling victim to these sophisticated cybercrimes.
Blog
Darby Wise, Piotr Glaska, Laura da Rocha
April 28, 2025
Uncovering Actor TTP Patterns and the Role of DNS in Investment Scams
Dive into the similarities between large-scale investment scams and learn how DNS abuse fuels this billion-dollar industry.
Blog
Infoblox Threat Intel
April 4, 2025
Disrupting Fast Flux and Much More with Protective DNS
Blog
Infoblox Threat Intel
March 27, 2025
A Phishing Tale of DoH and DNS MX Abuse
Large-scale phishing attacks use DoH and DNS MX records to dynamically serve fake login pages.
Blog
Jason Hill
March 13, 2025
Work Hard, Pay Harder!
Cybercriminals targeting individuals globally via messaging services with industrial-scale recruitment scam infrastructure.
Blog
Cricket Liu
March 10, 2025
How scammers hijack major brands
Blog
Renée Burton
March 6, 2025
Survey Says...It’s a Scam!
Blog
Bart Lenaerts-Bergmans
February 26, 2025
DNS Early Detection - Fast Propagating Fake Captcha distributes LummaStealer
Lumma Stealer, also known as LummaC2, is a type of malware that first appeared in 2022. It is designed to steal sensitive information from infected systems.
Blog
Infoblox Threat Intel
February 25, 2025
The Hidden Dangers of Malicious Adtech
Learn why malicious adtech is a risk for organizations of all sizes.
Blog
Renée Burton
January 27, 2025
Pushed Down the Rabbit Hole
The adverse impact of visiting compromised domains that integrate malicious adtech.
Blog
David Brunsdon
January 14, 2025
One Mikro Typo: How a simple DNS misconfiguration enables malware delivery by a Russian botnet
Russian threat actors combine domain name vulnerabilities with hidden router proxy techniques to scale their attacks while remaining shielded from detection.
Blog
Infoblox Threat Intel
January 8, 2025
Lessons from a Malspam Hunt
Blog
Infoblox Threat Intel
November 14, 2024
DNS Predators Hijack Domains to Supply their Attack Infrastructure
Learn how DNS threat actors hijack domains and use them in their malicious campaigns.
Blog
Dave Mitchell and Adam Casella
October 15, 2024
Beware of Domain Collisions: Are Your Internal Domains Registered Externally?
Learn why understanding this risk is crucial for safeguarding your organization’s digital identity and preventing unauthorized access.
Blog
Infoblox Threat Intel
September 18, 2024
No, Elon Musk was not in the U.S. Presidential Debate
Cybercriminals used presidential debate-themed deep fake YouTube videos to advertise cryptocurrency scams.
Blog
Infoblox Threat Intel
July 31, 2024
Who Knew? Domain Hijacking Is So Easy
Learn about the insidious DNS attack vector that threat actors are using to hijack domains from major brands, government institutions…
Blog
Kat Persighetti
July 29, 2024
Olympics Scammers Take Their Marks, Get Set, and Go!
Every iteration of the Olympic games is a major global event – fueling pride and competition, watched by millions in homes around the world,…
Press Release
Infoblox Threat Intel
July 22, 2024
Infoblox Exposes: Chinese Cybercrime Syndicate Linking European Football Sponsors, Human Trafficking and a Trillion-Dollar Illegal Gambling Economy
Blog
Maël Le Touz, Jacques Portal, Renée Burton,
and Elena Puga
July 22, 2024
Gambling is No Game: DNS Links Between Chinese Organized Crime and Sports Sponsorships
Learn how the detection of a single anomalous domain led to the discovery of a vast enterprise leveraging sports sponsorships for Chinese organized crime.
Report
Maël Le Touz, Jacques Portal, Renée Burton,
and Elena Puga
July 22, 2024
Vigorish Viper: A Venomous Bet
Press Release
Infoblox Threat Intel
July 17, 2024
Revolver Rabbit’s Million-Dollar Masquerade: Infoblox Uncovers The Hidden World of RDGAs
Blog
James Barnett
July 17, 2024
RDGAs: The Next Chapter in Domain Generation Algorithms
Blog
Renée Burton and Dave Mitchell
June 3, 2024
What a Show! An Amplified Internet Scale DNS Probing Operation
Learn how Chinese actors are probing DNS networks around the world and how an attack surface management tool is amplifying the suspicious activity.
Blog
Infoblox Threat Intel
May 28, 2024
VexTrio Viper Adds a New DNS TDS Domain
Blog
Dr. Renée Burton
April 29, 2024
Muddling Meerkat Blog Post
This paper introduces a perplexing actor, Muddling Meerkat, who appears to be a People’s Republic of China (PRC) nation state actor.
Report
Infoblox Threat Intel
April 29, 2024
Muddling Meerkat Report
Sometimes there are threats we can observe but not fully understand. This might be doubly
true when the evidence comes from Domain Name System (DNS) logs.
Solution Note
Infoblox
April 26, 2024
Threat Insight
Real Time Inspection of Enterprise Network DNS Traffic to Detect Unknown Threats.
Solution Note
Infoblox
April 26, 2024
Infoblox Threat Intel
Uplift the entire security stack by optimizing your custom blend of threat intelligence.
Blog
Infoblox Threat Intel
February 28, 2024
Beware the Shallow Waters: Savvy Seahorse Lures Victims to Fake Investment Platforms Through Facebook Ads
Media Article
Bleeping Computer
February 28, 2024
Savvy Seahorse gang uses DNS CNAME records to power investor scams
Blog
Infoblox Threat Intel
February 20, 2024
Ivanti Connect Secure VPN Exploitation – Correctly Interpreting DNS IoCs
Media Article
Tech Republic
February 9, 2024
Infoblox says IT Pros are Missing this Mega-Threat from Organised Global Cyber Criminals
Blog
Infoblox Threat Intel
January 23, 2024
Cybercrime Central: VexTrio Operates Massive Criminal Affiliate Program
DNS threat actor VexTrio runs a large-scale criminal affiliate program including ClearFake and SocGholish actors.
Solution Note
Infoblox
October 31, 2023
DNS-Based Threat Hunting For Unveiling Threats Early Before They Strike
The scope of DNS is enormous. There are now 1589 top level domains and 200,000 new
domains are created everyday.
Blog
Infoblox Threat Intel
October 31, 2023
Prolific Puma: Shadowy Link Shortening Service Enables Cybercrime
Learn how a link shortening service that supports cybercrime remained undetected for years and was discovered via Domain Name Service (DNS) analytics.
Media Article
Krebs on Security
October 31, 2023
.US Harbors Prolific Malicious Link Shortening Service
Blog
Infoblox Threat Intel
October 3, 2023
Lookalike Domain Attacks are on the Rise. Be on the Lookout for these Four Types
Explore the rise of lookalike domain attacks and their potential threats.
Webinar
Dr. Renée Burton
September 5, 2023
Decoy Dog is No Ordinary Pupy: Separating a Sly DNS Malware from the Pack
In April 2023, Infoblox disclosed the discovery of Decoy Dog, a malware toolkit that uses the domain name system (DNS) to perform command and control (C2).
Blog
Infoblox Threat Intel
July 25, 2023
Decoy Dog is No Ordinary Pupy: Separating a Sly DNS Malware from the Pack
The article provides a brief overview of our conclusions. Get the full report, including our Decoy Dog YARA rule, here and read the original paper here.
Report
Infoblox Threat Intel
July 25, 2023
Decoy Dog is No Ordinary Pupy: Separating a Sly DNS Malware from the Pack
Decoy Dog is a malware toolkit discovered by Infoblox that uses the domain name system (DNS) to perform command and control (C2).
Report
Infoblox Threat Intel
April 24, 2023
A Deep3r Look at Lookal1ke Attacks
Threat actors have used visually similar domains to deceive users into visiting malicious websites since the advent of the internet.
All Resources
Threat intelligence that powers preemptive security
Disrupt cybercrime pre-incident with threat insights derived from and designed for DNS.
Infoblox Threat Intel identifies adversarial infrastructure before malicious payloads can reach their victims.
Learn more about Infoblox Preemptive Security
About Our Team
Infoblox Threat Intel is the leading creator of original DNS threat intelligence, distinguishing itself in a sea of aggregators. What sets us apart? Two things: mad DNS skills and unparalleled visibility. DNS is notoriously tricky to interpret and hunt from, but our deep understanding and unique access to the internet’s inner workings allow us to track down threat actors that others can’t see. We’re truly proactive, not just defensive, using our insights to disrupt cybercrime where it originates.
We also believe in sharing knowledge to support the broader security community by publishing detailed research and releasing indicators on GitHub. In addition, our intel is seamlessly integrated into our Infoblox Protective DNS solutions, so customers automatically get its benefits, along with ridiculously low false positive rates.
DNS Threat Landscape Report: Discover key trends and techniques used by DNS threat actors with firsthand observations from Infoblox Threat Intel.
MASTODON
Follow the discussion on infosec.exchange
YOUTUBE
Learn more about actors and their techniques
GITHUB